stitch-vue-element-components
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes a bash script (scripts/fetch-stitch.sh) to download design HTML from URLs provided by the Stitch MCP. This is a functional requirement for accessing design assets stored in cloud buckets.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to run the local 'fetch-stitch.sh' script, which employs curl to ensure high-reliability downloads by handling redirects and TLS.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes external HTML and JSON design data. 1. Ingestion points: temp/source.html and Stitch MCP metadata. 2. Boundary markers: Absent. 3. Capability inventory: Bash, Write, Read, and web_fetch. 4. Sanitization: Absent. The agent relies on internal architectural rules to guide the conversion process safely.
Audit Metadata